If you know how to back up and then re-install windows then crack on

It's like nuking the site from orbit, "it's the only way to be sure"

You can spend many hours chasing down nasties and never 100% that they are gone.

Re-format on the other hand, one solution fixes all problems

If it's been routed then even that wouldn't work. MBR would need rewritten by repartitioning.

If it's been routed then even that wouldn't work. MBR would need rewritten by repartitioning.

Doesn't deleting and re writing the partiton take care of that though ? as if I thought there was a virus I would do this as matter of course.

The MBR and partition tables are separate. You can replace the MBR without changing your partition table and you can repartition without touching your MBR. I *think* an actual Windows installation would rewrite both, but I don't know about a hard drive-based Windows XP recovery system (some will, some won't) as this is more likely to be based around an image of the original software rather than a scripted setup process (in my experience).

Also bear in mind that if something has infected the recovery partition (which is possible, just because you can't see it in My Computer doesn't mean that it's not accessible at all) then restoring from that HD image would just be putting the infection straight back onto your live system.

I prefer to reinstall from known-clean CD/DVDs for that very reason, and always make recovery CD/DVDs of the hard drive recovery on any new machine out of the box.

http://forums.majorgeeks.com/showthread.php?t=205729

Not hard to clear the MBR but if you think you might have a rootkit you can't trust that a simple reformat will clear everything.

If you repartition that should rewrite the MBR. Also 'Fixing' the MBR should rewrite it and clear out any nasties.

I don't think rootkits are actually all that common. They're a good story for the IT press.

I don't think rootkits are actually all that common. They're a good story for the IT press.

Thats the school of thought I have been working on with for some time

http://forums.majorgeeks.com/showthread.php?t=205729

Not hard to clear the MBR but if you think you might have a rootkit you can't trust that a simple reformat will clear everything.

If you repartition that should rewrite the MBR. Also 'Fixing' the MBR should rewrite it and clear out any nasties.

I don't think rootkits are actually all that common. They're a good story for the IT press.

I know nothing about rootkits or other virus's etc, but i know the last time whatever infection my computer had only really went away when i rebooted from the recovery DVD.

My computer will do a system recovery without the disk which is from a partition on the hard drive i think. This is a short process, which only takes less than an hour, reinstalls all drivers etc and leaves data file intact. The recovery i want to do from the DVD will take up to 5 hours and will repartition the hard drive to start and then wipe everything including all data files. i am hoping, as this is as destructive a process i can do without sending it to a specialist, that this should rid the hard drive of all issues. Even so, i will install MSE antivirus, malwarebytes and CCleaner as a priority and run these before i go to the trouble of reinstalling my other software.

Oh, and i now have my copy of my recovery DVD which i hope the PC won't refuse to read.

First of all, someone suggested COMBOFIX; this is a very good program, but should ONLY be used by someone with a good understanding of pc systems, it can destroy everything on the hard drive if you pick the wrong option, or try to use it against the wrong virus.

2) AVG is not that good these days, but most of the viri and malware will try to disable the AV programs that are active when it infects the machine, and may will block access to the well known AV programs.

Malwarebytes is a very good program, but if you have a rootkit even it may be blocked.

Here is your best bet to remove the infections yourself; without formatting your hadd drives and starting from scratch.

Download these AV programs, Avast, Malwarebytes, Spybot S&D, COMBOFIX, SDFIX and Hijackthis!! on a friends computer and put onto a USB key, or burn to a CDROM.

Disconnect your PC from the internet physically and boot into "Safe Mode" (usually F8), during the boot sequence. Be aware that some rootkits alter the safeboot files, so it can take a LONG time; literally 10-15 minutes to get past a blank screen.

Try to install MwB and Spybot; if successful run a FULL scan with each (although not at the same time). They may prompt you to reboot to finish cleaning, if so, reboot into a normal windows session, then reboot into Safe mode" again and run another set of scans.

If the 2nd set of scans is clean, reconnect to the internet and reboot into "safe mode with networking", download the latest updates for the 2 programs and then repeat the above.

If this doesnt work, or they wont install, then you have a big problem, you have then got three options.

1/ join Bleeping Computer - Computer Help and Discussion and scream for help, which can take a few days; they will probably ask you to run Hijackthis, and then either COMBOFIX, or SDFIX and then MwB. (hence downloading them all ready!!)

2/ try running COMBOFIX and/or SDFIX yourself in "Safe mode"; but try and back up files you want to save to an external drive as below before trying either program. DO NOT USE A BACK UP IMAGE PROGRAM, manually copy the files without compressing them into .zip or .rar etc.

3/ Save as much data as you can to an external drive, CD/DVDR, USB drive or memory card, and low level format the hard drive; as mentioned above, your back-up image files are almost certainly infected as well.

Disconnect the back up from the PC and dont try to reconnect this back up until you have finished reinstalling the system, as well as Avast, MwB, Spybot (AND UPDATED THEM),and a good firewall, (Iuse ZoneAlarm, which isnt the BEST free one, but most suited to beginners).

Do an in depth scan with all three AV programs before trying to access any of the saved files.

Chrome and Firefox both have versions of adblock, but what you REALLY want, and I am not sure if it is available on Chrome is "NoScript", which stops all java and flash files running on webpages, as they are the largest vector for malware infections these days.

You can switch off NS on A PAGE BY PAGE, DOMAIN, OR EVEN TEMPORARY BASIS, so pages that NEED it can still be allowed to run it.

On an ongoing basis, because MwB and Spybot are not active all the time, infections dont always "see" them, so they are not always disabled by an infection., so update and run a scan with each program at least once per week

Spybot also has a list of known malware sites that it automatically blocks you from visiting, so make sure you run the "immunise" option after every update.

If you are very unlucky, nothing will work, some new viri are now lurking in the motherboard ROM or the hard drives own ROM, and so very difficult to remove. I have come across a few programs that try to restore the HDD ROM files, but there is nothing currently that can repair the mobo ROM, even if you have a dual ROM mobo.

(Ian is not an expert, but he likes delving into the dusty corners of the internet, and has a lot of idiot relatives who dont understand what a computer virus is)

Gentle Giant, i am in awe of your knowledge of computers .

Unfortunately I think i have gone past the stage of software fixes. I have tried on at least three different software solutions including malwarebytes, Avast and Microsoft free anti virus, but something is blocking any of them from running.

My intention is to firstly get the computer to a state where i can run these programmes, and then i will be going back through all the information posted by yourself and the other very helpful members of the forum with a fine toothed comb to ensure i am infection free and protected in future.

As I said, boot into "Safe Mode", this stops MOST malware from loading at start up, so they cannot block the installation of the AV programs. I have just had this exact issue on Lihong's computer. A real nightmare; I knew exactly what to do, but dont read Chinese and she is clueless when it comes to translating computer system messages into English.

Update:

I was out most of yesterday evening, but i did give Malwarebytes a go. I got onto the internet, downloaded Malwarebyte, and extracted and installed it onto my machine. All went well and i went through the usual programmes menu, found the linked and clicked to open it. Then, as with AVG, and all other such programmes over the past two days, i got an error message. This one said something like i do not have the permissions to open/run. I did try to open other programmes such as photoshop and Picassa which all still run.

Are you logged on as a user with Administrator priviledges? Perhaps the way you are set up mean that you have to to run/install some programs.

Just a thought.

After another failed attempt to reboot, all i got was an error message and a request to reinstall system disk, which i did but it didn't accept.

Eventually left it with my neighbour who works in computers (programming i think). He told me the disk drive was faulty and he rebooted and reformatted my machine from a usb key with a demo licence of Window 7 Premium (he doesn't have XP).

So, now the computer is up and running, but on it's last legs i feel. He also installed MSE antivirus and i will install malwarebytes and CCleaner myself. He had talked about stripping it and taking out the hard drive etc, but i said it wasn't worth it (the machine i mean).

Fingers crossed it doesn't die before february when i plan to invest no more than about £400 on a new machine (including new monitor).

Thanks again for all the help and advice.

Now it's back up and working, can you read CDs? If not then you could get an external CD drive pretty cheaply anyway, or even cheaper for a replacement internal drive.

http://www.ebuyer.com/174302-liteon-etdu108-8x-dvd-rom-usb-external-slim-optical-drive-retail-box-etdu108-02

http://www.ebuyer.com/173552-liteon-ihap122-22x-dvd-rw-dl-ram-ide-optical-drive-oem-ihap122-19

Which version of XP do you need? I'm guessing that there is a sticker on the side or back of the computer with the version on there. If there is, let me know which one and I will stick a disc in the post for you.

ebuyer are great, until you need to RMA something, then they are the worst people on the planet. 6 years is not ancient for PC parts, I have PCs that used to run Win98 and ME still going; the HDDs for instance, all used to come with a 5 year warranty, so they are only just out of warranty, CD/DVD drives though, especially the cheaper ones, do tend to develop a wobble that buggers up trying to read the .cab files on a Window CD/DVD, even though they will read most other data correctly. Still, a new DVDRW is only going to cost you £10-£15. If you ever have use for the floppy drive, KEEP the old one, the new ones are shockingly bad and fail in about a year, even with little of no use. If you have a license sticker but no CD for XP, just look on a few torrent sites for a suitable XP ISO file to download and burn. (or TinyXP, of which there are many variants, although these are not strictly speaking, entirely legal, I have not heard of a case of M$ suing someone for using their stock XP serial with a copy of TinyXP though)

Old PC's-mine is possibly samevintage .Built it approx sixyearsago - AMD 2.8G processor with 2m ram .Never really had any virus problems .Found Zone alarm firewall/anti virus does the trick .But I monitor cookies,rejecting a lot.Idea for the pros on here to comment on - my son & I found that the online security firms suggest win 7 /DDefender provides a high level of security -what I use now with zone alarm firewall( and a lot of commonsense with web sites) .Ironically the only problem I've had was with the fake virusprogram.And that took super antispyware to remove .

There is no program that is 100% effective, in fact many of the top brands are actually less than 70% effective; that is why it is a good idea to avoid using multiple products or "all in one" products from a single company, but "mix and match" multiple companies products. The first thing most virus and malware programs try to do is switch off your anti virus and anti malware programs, so having a 2nd "on demand" program that is not active in memory (and no not detected and disabled) is a good idea, I use Malwarebytes for this, as it is one of the best anti malware/ anti virus programs out there. Using a browser with added security features also helps, forget any propaganda about IE9, use FireFox or Opera and install AdBlock plus, NoScript, and FlagFox. AdBlock does what it says, which can not only speed up page loading times, but also blocks a common method for getting malware onto well known websites. NoScript blocks ALL active Java, Flash and Silverlight scripts, so you have to specifically allow those needed to make the webpage work, and allows you to permanently block scripts from Facebook, Google etc that can stop or slow down page loading when you have a slow connection, as well as trackers from various ad companies such as "doubleclick". The last one does not seem useful until you suddenly notice your bank has moved its servers from the UK to Nigeria or Ukraine like my mother did. FlagFox has a lot of useful features if you investigate it.